CVE-2026-18297
Received Received - Intake

Stack-based Buffer Overflow in GStreamer via OGG File Parsing

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: Zero Day Initiative

Description
GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OGG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29584.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-18297
EUVD
EUVD-2026-63446

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
gst_project gstreamer *
gstreamer gstreamer *
gstreamer gstreamer From 2026-05-21 (inc) to 2026-07-29 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stack-based buffer overflow vulnerability in GStreamer's OGG file parsing. It occurs when the software fails to properly validate the length of user-supplied data before copying it to a stack buffer. Attackers can exploit this by tricking users into opening a malicious OGG file or visiting a malicious page, allowing them to execute arbitrary code on the affected system.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of GStreamer. Inspect installed packages using commands like 'gst-inspect-1.0 --version' or 'apt list --installed | grep gstreamer' on Debian-based systems. Compare versions against the patched release noted in the advisory.

Impact Analysis

If exploited, this vulnerability could allow attackers to run malicious code on your system, potentially leading to data theft, system damage, or unauthorized access. Since user interaction is required, you could be impacted by simply opening a malicious file or visiting a compromised website.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations affected by this flaw may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update GStreamer to the latest patched version as recommended in the advisory. Avoid opening untrusted OGG files or visiting suspicious websites until the update is applied. Disable automatic media playback in browsers if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18297. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart